@struktoai/mirage-node 0.0.7 → 0.0.8

package/dist/config.js

@@ -11,39 +11,46 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 // ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { mcpCli } from '@struktoai/mirage-core/commands/cli/mcp/build';
+import { NAME as MCP_CLI } from '@struktoai/mirage-core/commands/cli/mcp/constants';
+import { CLI } from '@struktoai/mirage-core/commands/cli/types';
 import { CommandSpec } from '@struktoai/mirage-core/commands/spec/types';
 import { IOConfig } from '@struktoai/mirage-core/io/config';
+import { narrowed, networkBound, networkLayer, networkRoutes, NetworkRule, runWithNetwork, } from '@struktoai/mirage-core/io/network';
 import { parseCommandLimits } from '@struktoai/mirage-core/policy/builtin/output_cap';
-import { randomBytes } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { parseYaml } from "./utils/yaml.js";
-import { CLI } from '@struktoai/mirage-core/commands/cli/types';
+import { METHODS } from '@struktoai/mirage-core/policy/constants';
+import { compileProgram, parseProgram, SessionProfile, } from '@struktoai/mirage-core/policy/profile';
+import { validateDocument } from '@struktoai/mirage-core/rs/document';
 import { Runtime } from '@struktoai/mirage-core/runtime/base';
-import { ScriptSource } from '@struktoai/mirage-core/runtime/types';
 import { buildRuntime, checkRuntimeOptions } from '@struktoai/mirage-core/runtime/table';
-import { EnvVarSchema, SecretSourceSchema, } from '@struktoai/mirage-core/secrets/config';
-import { KERNEL_BACKENDS, MountBackend, MountMode, ReadPolicy, parseMountMode, } from '@struktoai/mirage-core/types';
-import { Mount } from '@struktoai/mirage-core/workspace/mount/spec';
+import { ScriptSource } from '@struktoai/mirage-core/runtime/types';
+import { EnvVar, SecretSource, } from '@struktoai/mirage-core/secrets/config';
+import { configHoldsPointer, resolveConfigSecrets, resolveSourcesFor, } from '@struktoai/mirage-core/secrets/sources';
+import { KERNEL_BACKENDS, MountBackend, MountMode, parseMountMode, ReadPolicy, } from '@struktoai/mirage-core/types';
+import { parseSystemTime } from '@struktoai/mirage-core/utils/clock';
+import { snakeToCamel } from '@struktoai/mirage-core/utils/normalize';
+import { isPlainObject } from '@struktoai/mirage-core/utils/records';
+import { parseLimit } from '@struktoai/mirage-core/utils/size';
+import { compareCodePoints } from '@struktoai/mirage-core/utils/sort';
+import { parseConfigWithSchema } from '@struktoai/mirage-core/vfs/secrets';
 import { coerceReadPolicy, resolveReadSpec, } from '@struktoai/mirage-core/workspace/mount/read_policy';
+import { Mount } from '@struktoai/mirage-core/workspace/mount/spec';
 import { coerceWritePolicy } from '@struktoai/mirage-core/workspace/mount/write_policy';
-import { snakeToCamel } from '@struktoai/mirage-core/utils/normalize';
-import { parseProgram, parseSessionProfile, } from '@struktoai/mirage-core/policy/profile';
 import { RAMWorkspaceStateStore } from '@struktoai/mirage-core/workspace/store/ram';
 import { S3WorkspaceStateStore } from '@struktoai/mirage-core/workspace/store/s3';
-import { normalizeS3Config } from "./vfs/s3/config.js";
-import { isModulePath, loadAttr, splitRef } from "./utils/loader.js";
+import { readFileSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 // The config loader is a workspace entry point of its own (the daemon
 // builds from here), so it arms the builtin secrets sources like the
 // node Workspace module does.
-import { configHoldsPointer, resolveConfigSecrets, resolveSourcesFor, } from '@struktoai/mirage-core/secrets/sources';
 import "./secrets/constants.js";
+import { releaseNetwork, watchNetwork } from "./io/network.js";
+import { isModulePath, loadAttr, splitRef } from "./utils/loader.js";
+import { parseYaml } from "./utils/yaml.js";
 import { buildVfs } from "./vfs/registry.js";
-import { RedisConsoleStore } from "./shell/console/redis/index.js";
+import { S3Config } from "./vfs/s3/config.js";
 import { DiskWorkspaceStateStore } from "./workspace/store/disk.js";
 import { RedisWorkspaceStateStore } from "./workspace/store/redis.js";
-import { JobConsole } from '@struktoai/mirage-core/shell/console/index';
-import { compareCodePoints } from '@struktoai/mirage-core/utils/sort';
 function coerceMountMode(value, fallback) {
     if (value === undefined)
         return fallback;
@@ -121,147 +128,8 @@ function camelizeKeys(obj) {
         out[snakeToCamel(k)] = v;
     return out;
 }
-function isPlainObject(v) {
-    return v !== null && typeof v === 'object' && !Array.isArray(v);
-}
-// Python sets extra="forbid" on every workspace-config block, so a typo
-// like `mount_point:` for `mountpoint:`, `consistancy:` or `limitt:` is
-// a hard ValueError there. These tables mirror those models field for
-// field so the same YAML is accepted (and rejected) by both languages.
-//
-// The spellings are Python's canonical snake_case ones on purpose: a
-// camelCase alias that TS would accept for free is a key Python rejects,
-// which is the same portability break pointing the other way.
-//
-// `mounts.*.config` is the one block with no table, because Python types
-// it as a bare dict and validates it in the VFS's own model. Do not
-// generalize that to every credential-carrying block: an s3 store group
-// has a strict Python model (`S3StoreBlock`, extra="forbid"), so it is
-// tabled here like the rest.
-const TOP_LEVEL_KEYS = [
-    'mounts',
-    'io',
-    'command_limits',
-    'clis',
-    'runtimes',
-    'route_policy',
-    'profiles',
-    'profile',
-    'mode',
-    'read',
-    'write',
-    'default_session_id',
-    'workspace_id',
-    'cache',
-    'index',
-    'store',
-    'console',
-    'env',
-    'secrets',
-];
-const MOUNT_KEYS = [
-    'vfs',
-    'mode',
-    'config',
-    'command_limits',
-    'backend',
-    'mountpoint',
-    'read',
-    'ttl',
-    'write',
-    'index',
-];
-// A source instance is a type beside a config, the way a mount is. Its
-// `config:` block has no table for the same reason `mounts.*.config`
-// has none: each source owns its own model and validates there.
-const SOURCE_KEYS = ['source', 'config'];
-const CACHE_KEYS = {
-    ram: ['type', 'limit', 'max_drain_bytes'],
-    redis: ['type', 'limit', 'max_drain_bytes', 'url', 'key_prefix'],
-};
-const INDEX_KEYS = {
-    ram: ['type', 'ttl'],
-    redis: ['type', 'ttl', 'url', 'key_prefix'],
-};
-const CONSOLE_KEYS = {
-    ram: ['type'],
-    redis: ['type', 'url', 'key_prefix', 'ttl_seconds'],
-};
-const STORE_GROUPS = ['namespace', 'observer', 'workspace'];
-const STORE_KEYS = ['type', 'url', 'key_prefix', 'root', ...STORE_GROUPS];
-// An s3 group IS `S3Config` plus the discriminator, so its keys are that
-// model's, spelled Python's way. Python declares it as
-// `S3StoreBlock(S3Config)` with extra="forbid" — a strict model, unlike
-// the untyped `mounts.*.config` — so a typo is a load error there and
-// must be one here.
-const STORE_GROUP_KEYS = {
-    ram: ['type'],
-    disk: ['type', 'root'],
-    redis: ['type', 'url', 'key_prefix'],
-    s3: [
-        'type',
-        'bucket',
-        'region',
-        'endpoint_url',
-        'aws_access_key_id',
-        'aws_secret_access_key',
-        'aws_session_token',
-        'aws_profile',
-        'path_style',
-        'timeout',
-        'proxy',
-        'key_prefix',
-    ],
-};
-// The s3 store hosts only the sessions+meta plane, so it is valid as the
-// `workspace` override and nowhere else — as the top-level default it is
-// already refused above. Its store raises when asked to build another
-// plane; both languages now refuse the config instead of the plane.
-const S3_HOSTED_GROUP = 'workspace';
-const PLAIN_STORE_GROUP_KEYS = Object.fromEntries(Object.entries(STORE_GROUP_KEYS).filter(([type]) => type !== 's3'));
+const STORE_GROUPS = ['namespace', 'observer', 'workspace', 'jobs'];
 const CLI_KEYS = ['cli', 'script', 'runtime', 'config'];
-// A store group whose `type` names a backend carries that backend's own
-// spellings: `aws_access_key_id` is `accessKeyId`, not `awsAccessKeyId`,
-// so camelizing here would hide the key from the translation that does
-// know it. Its *keys* are still checked — the backend's model declares
-// them (see STORE_GROUP_KEYS above) — only the renaming is skipped.
-const BACKEND_SPELLED_TYPES = new Set(['s3']);
-function keepsBackendSpellings(block) {
-    return typeof block.type === 'string' && BACKEND_SPELLED_TYPES.has(block.type);
-}
-function rejectUnknownKeys(block, allowed, what) {
-    for (const key of Object.keys(block)) {
-        if (allowed.includes(key))
-            continue;
-        throw new Error(`unknown ${what} key \`${key}\` (allowed: ${allowed.join(', ')})`);
-    }
-}
-/**
- * The `type:` discriminator of a typed block. `fallback` is the type
- * assumed when the key is absent; leave it out where Python models the
- * block as a discriminated union, which makes `type` mandatory.
- */
-function blockType(block, what, known, fallback) {
-    const type = block.type ?? fallback;
-    if (type === undefined) {
-        throw new Error(`config \`${what}\` needs a \`type\` (one of ${known.join(', ')})`);
-    }
-    if (typeof type !== 'string') {
-        throw new Error(`config \`${what}\` type must be a string (one of ${known.join(', ')})`);
-    }
-    if (!known.includes(type)) {
-        throw new Error(`unknown ${what} type \`${type}\` (expected one of ${known.join(', ')})`);
-    }
-    return type;
-}
-function validateTypedBlock(value, table, what, fallback) {
-    if (value === undefined || value === null)
-        return;
-    if (!isPlainObject(value))
-        throw new Error(`config \`${what}\` must be a mapping`);
-    const type = blockType(value, what, Object.keys(table), fallback);
-    rejectUnknownKeys(value, table[type] ?? [], `${what} (${type})`);
-}
 // Python's index block models refuse a ttl that is not a number
 // (StrictFloat) and a non-string url or key_prefix at load. This stops at
 // the first bad value, so it checks them in the models' field order.
@@ -278,54 +146,6 @@ function validateIndexValues(value, what) {
         throw new Error(`config \`${what}.key_prefix\` must be a string`);
     }
 }
-// Key names alone are not enough here: Python's Pydantic model rejects
-// `url: 123` at load, so the TS loader must refuse the same file at the
-// same boundary instead of deferring it to Redis client creation.
-function validateConsoleValues(value) {
-    if (!isPlainObject(value))
-        return;
-    if (value.url !== undefined && typeof value.url !== 'string') {
-        throw new Error('config `console.url` must be a string');
-    }
-    if (value.key_prefix !== undefined && typeof value.key_prefix !== 'string') {
-        throw new Error('config `console.key_prefix` must be a string');
-    }
-    const ttl = value.ttl_seconds;
-    if (ttl !== undefined &&
-        ttl !== null &&
-        !(typeof ttl === 'number' && Number.isFinite(ttl) && ttl > 0)) {
-        throw new Error('config `console.ttl_seconds` must be a positive number or null');
-    }
-}
-function validateStoreBlock(value) {
-    if (value === undefined || value === null)
-        return;
-    if (!isPlainObject(value))
-        throw new Error('config `store` must be a mapping');
-    // The top level picks the default backend for every plane; s3 hosts
-    // only the sessions+meta group, so it is a `workspace` override and
-    // never the default. Mirrors Python's StoreBlock.
-    blockType(value, 'store', ['ram', 'disk', 'redis'], 'ram');
-    rejectUnknownKeys(value, STORE_KEYS, 'store');
-    for (const group of STORE_GROUPS) {
-        const block = value[group];
-        if (block === undefined || block === null)
-            continue;
-        if (!isPlainObject(block))
-            throw new Error(`config \`store.${group}\` must be a mapping`);
-        if (block.type === 's3' && group !== S3_HOSTED_GROUP) {
-            throw new Error(`config \`store.${group}\` cannot be s3: the s3 store hosts only the ` +
-                `sessions+meta group; keep the ${group} plane on ram or redis and pass ` +
-                `the s3 store as the '${S3_HOSTED_GROUP}' group override`);
-        }
-        const table = group === S3_HOSTED_GROUP ? STORE_GROUP_KEYS : PLAIN_STORE_GROUP_KEYS;
-        validateTypedBlock(block, table, `store.${group}`, 'ram');
-    }
-}
-/** A raw block's `config`, or an empty mapping when it is absent or not one. */
-function asConfig(value) {
-    return isPlainObject(value) ? value : {};
-}
 /**
  * Refuse a mount block whose read policy and bound disagree.
  *
@@ -366,8 +186,20 @@ function validateReadBlock(prefix, block) {
  * folds snake_case into camelCase and the distinction is gone.
  */
 function validateConfigKeys(raw) {
-    rejectUnknownKeys(raw, TOP_LEVEL_KEYS, 'config');
+    validateDocument('config', raw, 'config');
     parseCommandLimits(raw.command_limits);
+    if (raw.max_memory !== undefined && raw.max_memory !== null) {
+        parseLimit(raw.max_memory, 'max_memory');
+    }
+    if (raw.network !== undefined) {
+        const layer = networkLayer(raw.network);
+        new NetworkRule(layer === null ? [] : [layer], false, networkRoutes(raw.network));
+    }
+    if (raw.system_time !== undefined && raw.system_time !== null) {
+        if (typeof raw.system_time !== 'string')
+            throw new Error('system_time must be a string');
+        parseSystemTime(raw.system_time);
+    }
     // At the sync entry point, as Python's WorkspaceConfig validator is, so the CLI
     // refuses a bad value before it POSTs the document to the daemon.
     if (raw.read !== undefined && raw.read !== null)
@@ -378,9 +210,9 @@ function validateConfigKeys(raw) {
         for (const [prefix, block] of Object.entries(raw.mounts)) {
             if (!isPlainObject(block))
                 throw new Error(`mount \`${prefix}\` must be a mapping`);
-            rejectUnknownKeys(block, MOUNT_KEYS, `mount \`${prefix}\``);
+            validateDocument('config', block, `mount \`${prefix}\``, { names: 'mount' });
             // Before the read rules, as pydantic checks fields before them.
-            validateTypedBlock(block.index, INDEX_KEYS, `mounts.${prefix}.index`);
+            validateDocument('config', block.index, `mounts.${prefix}.index`, { names: 'index' });
             validateIndexValues(block.index, `mounts.${prefix}.index`);
             validateReadBlock(prefix, block);
             if (block.write !== undefined && block.write !== null)
@@ -392,14 +224,15 @@ function validateConfigKeys(raw) {
         for (const [name, block] of Object.entries(raw.clis)) {
             if (!isPlainObject(block))
                 throw new Error(`cli \`${name}\` must be a mapping`);
-            rejectUnknownKeys(block, CLI_KEYS, `cli \`${name}\``);
+            validateDocument('config', block, `cli \`${name}\``, { names: 'cli' });
             // A pointer may only fill a config that a model validates, because
             // the model is what a snapshot redacts by. A script's config is
             // opaque: nothing declares which key is a credential, so the
             // snapshot captures it verbatim, and a pointer resolved into it
             // would be written out as the value it fetched. Refused here, on
             // the block, so every entry point that reads a config inherits the rule.
-            if (typeof block.script === 'string' && configHoldsPointer(asConfig(block.config))) {
+            if (typeof block.script === 'string' &&
+                configHoldsPointer(isPlainObject(block.config) ? block.config : {})) {
                 throw new Error(`clis entry '${name}': a script's config is opaque and a pointer in it would be ` +
                     'written into every snapshot; read the credential from a managed env var instead');
             }
@@ -425,15 +258,16 @@ function validateConfigKeys(raw) {
     if (raw.io !== undefined) {
         if (!isPlainObject(raw.io))
             throw new Error('io must be a mapping');
-        rejectUnknownKeys(raw.io, ['buffer_bytes'], 'io');
+        validateDocument('config', raw.io, 'io', { names: 'io' });
         new IOConfig(camelizeKeys(raw.io));
     }
-    validateTypedBlock(raw.cache, CACHE_KEYS, 'cache');
-    validateTypedBlock(raw.index, INDEX_KEYS, 'index');
+    validateDocument('config', raw.cache, 'cache', { names: 'cache' });
+    if (isPlainObject(raw.cache) && raw.cache.limit !== undefined) {
+        parseLimit(raw.cache.limit, 'limit');
+    }
+    validateDocument('config', raw.index, 'index', { names: 'index' });
     validateIndexValues(raw.index, 'index');
-    validateTypedBlock(raw.console, CONSOLE_KEYS, 'console');
-    validateConsoleValues(raw.console);
-    validateStoreBlock(raw.store);
+    validateDocument('config', raw.store, 'store', { names: 'store' });
     validateEnvBlock(raw.env);
     validateSecretsBlock(raw.secrets);
 }
@@ -453,8 +287,8 @@ function validateSecretsBlock(value) {
     for (const [name, block] of Object.entries(value)) {
         if (!isPlainObject(block))
             throw new Error(`config \`secrets.${name}\` must be a mapping`);
-        rejectUnknownKeys(block, SOURCE_KEYS, `config \`secrets.${name}\``);
-        const parsed = SecretSourceSchema.safeParse(block);
+        validateDocument('config', block, `config \`secrets.${name}\``, { names: 'source' });
+        const parsed = SecretSource.safeParse(block);
         if (!parsed.success) {
             const detail = parsed.error.issues[0]?.message ?? parsed.error.message;
             throw new Error(`config \`secrets.${name}\`: ${detail}`);
@@ -479,7 +313,7 @@ function validateEnvBlock(value) {
         if (!isPlainObject(entry)) {
             throw new Error(`config \`env.${name}\` must be a string or a mapping`);
         }
-        const parsed = EnvVarSchema.safeParse(entry);
+        const parsed = EnvVar.safeParse(entry);
         if (!parsed.success) {
             const detail = parsed.error.issues[0]?.message ?? parsed.error.message;
             throw new Error(`config \`env.${name}\`: ${detail}`);
@@ -502,8 +336,6 @@ function normalizeConfigKeys(raw) {
         out.cache = camelizeKeys(out.cache);
     if (isPlainObject(out.index))
         out.index = camelizeKeys(out.index);
-    if (isPlainObject(out.console))
-        out.console = camelizeKeys(out.console);
     if (isPlainObject(out.mounts)) {
         out.mounts = Object.fromEntries(Object.entries(out.mounts).map(([prefix, block]) => [
             prefix,
@@ -518,7 +350,10 @@ function normalizeConfigKeys(raw) {
             const block = store[group];
             if (!isPlainObject(block))
                 continue;
-            if (keepsBackendSpellings(block))
+            // An s3 group carries its backend's own spellings (`aws_access_key_id`
+            // is `accessKeyId`), which a plain camelize would hide from the
+            // translation that knows them.
+            if (block.type === 's3')
                 continue;
             store[group] = camelizeKeys(block);
         }
@@ -558,7 +393,7 @@ function parseProfiles(raw) {
         // has rebased the path onto the config file's directory, so reading
         // it here would resolve against the process cwd. The workspace entry point
         // (`toWorkspaceOptions`) loads it, the python loader's split.
-        out[name] = parseSessionProfile(block, `profile \`${name}\``);
+        out[name] = SessionProfile(block, `profile \`${name}\``);
     }
     return out;
 }
@@ -569,29 +404,52 @@ function loadProgram(program) {
         : program;
 }
 /**
- * Load each profile's path-form policy programs into ScriptSources.
+ * Load a profile's path-form policy programs into ScriptSources.
  *
  * By this entry point the path is absolute for a file config (the check entry point
  * rebased it onto the config file's directory); an object config's
  * relative path resolves against the process cwd, as in Python. Code
  * that passes a loaded ScriptSource is left alone.
  */
-function loadProfileScripts(profiles) {
-    const out = {};
-    for (const [name, profile] of Object.entries(profiles)) {
-        const policy = profile.policy;
-        out[name] =
-            policy == null
-                ? profile
-                : {
-                    ...profile,
-                    policy: Object.fromEntries(Object.entries(policy).map(([method, programs]) => [
-                        method,
-                        programs.map(loadProgram),
-                    ])),
-                };
+export function loadProfilePolicy(profile) {
+    const policy = profile.policy;
+    return policy == null
+        ? profile
+        : {
+            ...profile,
+            policy: Object.fromEntries(Object.entries(policy).map(([method, programs]) => [method, programs.map(loadProgram)])),
+        };
+}
+/**
+ * Load a server's policy file: a profile's `policy` block, a mapping of
+ * method to programs, plus `pre_workspace`, which a server asks before it
+ * builds a workspace. A relative `script` path is read next to the file,
+ * after `${VAR}` interpolation. Mirrors Python's `load_policy_file`.
+ */
+export function loadPolicyFile(path, env) {
+    const raw = interpolateEnv(parseYaml(readFileSync(path, 'utf8')), env ?? readProcessEnv());
+    const methods = [...Object.values(METHODS), 'pre_workspace'];
+    if (!isPlainObject(raw)) {
+        throw new Error(`${path}: a policy file is a mapping of method to programs`);
+    }
+    const unknown = Object.keys(raw).filter((key) => !methods.includes(key));
+    if (unknown.length > 0) {
+        throw new Error(`${path}: names ${unknown.sort(compareCodePoints).join(', ')}; a program answers at ` +
+            methods.join(', '));
+    }
+    const base = dirname(resolve(path));
+    const scripts = {};
+    for (const [method, programs] of Object.entries(raw)) {
+        if (!Array.isArray(programs))
+            throw new Error(`${path}: ${method} is a list of programs`);
+        scripts[snakeToCamel(method)] = programs.map((program, i) => {
+            if (isPlainObject(program))
+                absolutizeScriptKey(program, base);
+            const parsed = parseProgram(program, `${path}: ${method}[${String(i)}]`);
+            return compileProgram(loadProgram(parsed), basename(path));
+        });
     }
-    return out;
+    return scripts;
 }
 const VAR_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 function walkInterpolate(v, env, missing) {
@@ -641,6 +499,8 @@ export function readProcessEnv() {
 }
 /**
  * Interpolate `${VAR}` and check every key, leaving the spelling alone.
+ * `env` is where a name is read, the process's by default; null reads
+ * none and leaves every `${VAR}` as written.
  *
  * This is the shape that travels: the CLI prepares a config here and
  * POSTs it, and the daemon runs the same check on what arrives, so the
@@ -651,8 +511,7 @@ export function readProcessEnv() {
  */
 export function checkWorkspaceConfig(source, env) {
     const raw = { ...source };
-    const useEnv = env ?? readProcessEnv();
-    const interpolated = interpolateEnv(raw, useEnv);
+    const interpolated = env === null ? raw : interpolateEnv(raw, env ?? readProcessEnv());
     const mounts = interpolated.mounts;
     if (mounts === undefined ||
         typeof mounts !== 'object' ||
@@ -822,32 +681,10 @@ function buildStoreGroup(block) {
         // not survive a plain camelize.
         const s3 = { key_prefix: 'mirage/', ...block };
         delete s3.type;
-        return new S3WorkspaceStateStore(normalizeS3Config(s3));
+        return new S3WorkspaceStateStore(parseConfigWithSchema(S3Config, s3));
     }
     return new RAMWorkspaceStateStore();
 }
-// Build one job's console on its own Redis stream. The key carries a
-// fresh nonce beside the job id, because job ids restart at 1 when the
-// table empties and a reused stream would replay the previous job's
-// chunks. The minted prefix is published as the store's keyPrefix
-// (reachable as job.console.store), so an embedder can hand a reader
-// in another process the console's address. Keys expire ttl_seconds
-// after the last append (default one day) so finished jobs cannot
-// accumulate in Redis forever. The workspace closes what this builds
-// at teardown (JobTable.closeConsoles). Mirrors Python's
-// _redis_console.
-function buildConsoleFactory(block) {
-    if (block?.type !== 'redis')
-        return undefined;
-    const url = block.url ?? 'redis://localhost:6379/0';
-    const keyPrefix = block.keyPrefix ?? 'mirage:console:';
-    const ttlSeconds = block.ttlSeconds === undefined ? 86400 : block.ttlSeconds;
-    return (jobId) => new JobConsole(new RedisConsoleStore({
-        url,
-        keyPrefix: `${keyPrefix}${randomBytes(6).toString('hex')}:${jobId.toString()}:`,
-        ...(ttlSeconds !== null ? { ttlSeconds } : {}),
-    }));
-}
 function buildStateStore(block) {
     if (block === null || block === undefined)
         return undefined;
@@ -855,11 +692,13 @@ function buildStateStore(block) {
         ...(block.namespace != null ? { namespace: buildStoreGroup(block.namespace) } : {}),
         ...(block.observer != null ? { observer: buildStoreGroup(block.observer) } : {}),
         ...(block.workspace != null ? { workspace: buildStoreGroup(block.workspace) } : {}),
+        ...(block.jobs != null ? { jobs: buildStoreGroup(block.jobs) } : {}),
     };
     if (block.type === 'redis') {
         return new RedisWorkspaceStateStore({
             ...(block.url !== undefined ? { url: block.url } : {}),
             ...(block.keyPrefix !== undefined ? { keyPrefix: block.keyPrefix } : {}),
+            ...(block.root !== undefined ? { root: block.root } : {}),
             ...overrides,
         });
     }
@@ -871,6 +710,13 @@ function buildStateStore(block) {
     }
     return new RAMWorkspaceStateStore(overrides);
 }
+/**
+ * The mounts and the options `new Workspace` takes, minus the two the loader
+ * always resolves. The options are `WorkspaceOptions` itself: spelling the
+ * fields out instead is what once dropped `clis` and the deny rules on the
+ * way to the daemon, a config knob parsed and validated, then discarded by
+ * a list nobody remembered to extend.
+ */
 export async function configToWorkspaceArgs(cfg) {
     const wsMode = coerceMountMode(cfg.mode, MountMode.WRITE);
     const defaultRead = resolveReadSpec(cfg.read, undefined);
@@ -904,18 +750,37 @@ export async function configToWorkspaceArgs(cfg) {
     }
     const index = buildIndexConfig(cfg.index);
     const stateStore = buildStateStore(cfg.store);
-    const cliEntries = cfg.clis !== undefined && cfg.clis !== null
-        ? await buildCliEntries(cfg.clis, sources)
-        : undefined;
+    const clis = cfg.clis;
+    const mcp = clis !== undefined &&
+        clis !== null &&
+        Object.values(clis).some((block) => isPlainObject(block) && block.cli === MCP_CLI);
+    // An MCP entry is listed at load, under the config's network and any rule already bound.
+    const bound = networkBound();
+    const rule = mcp ? narrowed(bound, cfg.network ?? true) : bound;
+    if (rule !== null)
+        watchNetwork();
+    let cliEntries;
+    try {
+        cliEntries =
+            clis !== undefined && clis !== null
+                ? await runWithNetwork(rule, () => buildCliEntries(clis, sources))
+                : undefined;
+    }
+    finally {
+        if (rule !== null && rule !== bound)
+            await releaseNetwork(rule);
+    }
     const runtimeEntries = cfg.runtimes !== undefined && cfg.runtimes !== null
         ? await buildRuntimeEntries(cfg.runtimes)
         : undefined;
-    const consoleFactory = buildConsoleFactory(cfg.console);
     return {
         mounts,
         options: {
             mode: wsMode,
             commandLimits: parseCommandLimits(cfg.commandLimits),
+            ...(cfg.maxMemory !== undefined ? { maxMemory: cfg.maxMemory } : {}),
+            ...(cfg.network !== undefined ? { network: cfg.network } : {}),
+            ...(cfg.systemTime !== undefined ? { systemTime: cfg.systemTime } : {}),
             io: new IOConfig(cfg.io),
             read: defaultRead,
             write: defaultWrite,
@@ -928,13 +793,17 @@ export async function configToWorkspaceArgs(cfg) {
             // would ever release. Mirrors the `owns_store` Python's loader
             // sets beside the same store.
             ...(stateStore !== undefined ? { store: stateStore, ownsStore: true } : {}),
-            ...(consoleFactory !== undefined ? { consoleFactory } : {}),
             ...(runtimeEntries !== undefined ? { runtimes: runtimeEntries } : {}),
             ...(cfg.routePolicy !== undefined && cfg.routePolicy !== null
                 ? { routePolicy: loadProgram(parseProgram(cfg.routePolicy, 'route_policy')) }
                 : {}),
             ...(cfg.profiles !== undefined && cfg.profiles !== null
-                ? { profiles: loadProfileScripts(parseProfiles(cfg.profiles)) }
+                ? {
+                    profiles: Object.fromEntries(Object.entries(parseProfiles(cfg.profiles)).map(([name, profile]) => [
+                        name,
+                        loadProfilePolicy(profile),
+                    ])),
+                }
                 : {}),
             ...(cfg.profile !== undefined && cfg.profile !== null
                 ? { profile: cfg.profile }
@@ -1001,7 +870,8 @@ function looksLikeCliSpec(value) {
                 return false;
         }
         const subcommands = node.subcommands;
-        pending.push(...subcommands);
+        for (const item of subcommands)
+            pending.push(item);
     }
     return true;
 }
@@ -1024,7 +894,11 @@ function asCliSpec(value, name, ref) {
         return new CLI(value);
     throw new Error(`clis entry '${name}': ${ref} is not a CLI`);
 }
-async function buildCliEntries(clis, sources) {
+/**
+ * Each `clis:` entry checked and resolved to its tree and its config, pointers
+ * read; an `mcp` entry's tree is listed from its server.
+ */
+export async function buildCliEntries(clis, sources) {
     const out = {};
     for (const [name, block] of Object.entries(clis)) {
         // The raw config arrives as unvalidated YAML: the CLIBlock type is
@@ -1058,20 +932,21 @@ async function buildCliEntries(clis, sources) {
         // is synchronous. A `vfs:` value reads the same way, resolved by
         // `buildVfs` rather than here, because a mount block reaches the
         // registry and a `clis` block does not.
+        // `cli: mcp` names no registered tree: the tree is its server's tool list.
         const entry = hasScript
             ? new CLI({
                 spec: new CommandSpec({ name }),
                 script: loadScriptSource(block.script),
                 runtime: block.runtime ?? null,
             })
-            : await resolveCliRef(block.cli, name);
+            : block.cli === MCP_CLI
+                ? null
+                : await resolveCliRef(block.cli, name);
         // A CLI credential reads a pointer the way a mount's does: the
         // account CLI's `config_model` is the same model a VFS
         // parses, so it must receive the credential, not the pointer.
-        out[name] = [
-            entry,
-            await resolveConfigSecrets(block.config ?? {}, sources, `clis.${name}.config`),
-        ];
+        const config = await resolveConfigSecrets(block.config ?? {}, sources, `clis.${name}.config`);
+        out[name] = [entry ?? (await mcpCli(config)), config];
     }
     return out;
 }